An authenticated user with the Restore Operator role, who also controls the contents of a backed‑up NAS share, can place attacker‑controlled files at an arbitrary path on the Veeam backup server by using relative path traversal. The core weakness is a directory traversal flaw (CWE‑22) that bypasses normal path validation, allowing overwriting or creation of files outside the intended backup directory. This can compromise the integrity of backup files and serve as a foothold for further attacks on the backup server.

Veeam Backup and Replication is affected. Version information was not specified in the advisory, so the risk applies to all installations that grant Restore Operator privileges to users with control over the contents of backed‑up NAS shares.

The CVSS score of 5.9 indicates moderate severity. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with Restore Operator rights and the ability to provide files for the backup, implying that an attacker may need compromised credentials or an initial foothold. Once exploited, the attacker can write arbitrary files, potentially installing malware or modifying backup data for future exfiltration or persistence. Mitigation is recommended promptly as the flaw permits unrestricted file writes on the backup server.